AlignerrCybersecurity
Incident Response Lead, Cyber Security
up to $80/hr
About this role, in Alignerr's words
What if your hard-won experience in SOC operations could directly strengthen how organizations detect, respond to, and contain cyber threats? We're looking for a seasoned Incident Response Lead to evaluate real-world security operations — scrutinizing detection workflows, response playbooks, and triage logic to identify what's working, what isn't, and what needs to change.
What you'll do
- Review detection alerts, triage workflows, and escalation pathways for quality and consistency
- Evaluate the completeness and effectiveness of incident response actions across real-world scenarios
- Identify gaps in logging coverage, detection logic, and containment strategies
Show all 7 itemsHide the other 4 in What you'll do
- Summarize incident patterns, operational bottlenecks, and systemic weaknesses
- Validate response playbooks for clarity, accuracy, and practical feasibility under pressure
- Support recurring assessments of SOC maturity and operational readiness
- Produce structured, analytical documentation that drives meaningful operational improvements
Quoted from selected sections of Alignerr's posting. The full posting may state other conditions. Read the full posting
A closer look
More context, when you need it.
Full job descriptionThe original posting, in Alignerr's words
Posted by Alignerr, reproduced here so you can judge the role before clicking. Original posting ↗
Incident Response Lead, Cyber Security
About the Role
What if your hard-won experience in SOC operations could directly strengthen how organizations detect, respond to, and contain cyber threats? We're looking for a seasoned Incident Response Lead to evaluate real-world security operations — scrutinizing detection workflows, response playbooks, and triage logic to identify what's working, what isn't, and what needs to change.
This is a fully remote, flexible contract role built for experienced security professionals who think in timelines, escalation trees, and containment logic.
- Type: Hourly Contract - Location: Remote - Commitment: Flexible, based on project scope
What You'll Do
* Review detection alerts, triage workflows, and escalation pathways for quality and consistency * Evaluate the completeness and effectiveness of incident response actions across real-world scenarios * Identify gaps in logging coverage, detection logic, and containment strategies * Summarize incident patterns, operational bottlenecks, and systemic weaknesses * Validate response playbooks for clarity, accuracy, and practical feasibility under pressure * Support recurring assessments of SOC maturity and operational readiness * Produce structured, analytical documentation that drives meaningful operational improvements
Who You Are
Must-Have: * Hands-on experience in SOC operations, incident response leadership, or cybersecurity operations * Strong command of detection engineering, response workflows, and incident timeline analysis * Ability to critically assess triage quality, escalation logic, and containment decisions * Clear, structured analytical writing skills — you can translate complex findings into actionable documentation
Nice to Have: * Familiarity with SIEM platforms (Splunk, Microsoft Sentinel, Chronicle, etc.) * Experience with EDR tools and cloud-native detection systems * Background in red team / blue team exercises or SOC maturity assessments * Relevant certifications such as GCIH, GCFA, CISSP, or equivalent
Why Join Us
* Apply deep domain expertise to real, consequential security assessments * Fully remote and flexible — work when and where it suits you * Freelance autonomy with the structure of meaningful, project-based work * Make a direct impact on how organizations prepare for and respond to cyber threats * Potential for ongoing engagements and contract extension as new projects launch
Working with AlignerrPay, getting started and work, from Alignerr's own pages
What the platform publishes in general. These are not extra terms confirmed for this particular role.
- Getting paid
- Billed weekly, Monday to Sunday, with approved work paid by the following Friday, according to Labelbox's help center. Payment goes through Stripe Connect or PayPal depending on your location, with one provider per country. intercom.help/labelbox/en/articles/13600616-alignerr-paym..., alignerr.com/process
- Before your first paid task
- Sign up, apply, verify your identity, set up billing and onboard. Some jobs add a Zara AI interview or domain assessments. alignerr.com/process
- How much work
- Time to your first project depends on demand and your skills, and there is no minimum number of hours. alignerr.com/faqs
- Contract
- Independent contractor, under terms with ALIGNERR LLC. alignerr.com/faqs, alignerr.com/privacy
Read on the pages linked above on 24 Sep 2026. Platforms change these terms, so check the linked page before you rely on one.
How does the pay compare?Across Cybersecurity roles, not this role alone
From our own daily reads of every open listing on the platforms we follow, not from Alignerr's posting. How we count.
Pay across the field: Cybersecurity
Across 54 roles in this field with a stated hourly rate in US dollars, on 10 platforms, the middle half pays $60 to $120 an hour at the top of the range, and the median is $90. This role's top rate, $80, is in the middle half. Of the 27 distinct rates we count, 10 are lower and 15 are higher.
| Platform | Roles | Top of range, per hour |
|---|---|---|
| Alignerr (this platform) | 31 | $55 to $120 · median $60 |
| Mercor | 4 | $90 to $250 |
| micro1 | 4 | $95 to $175 |
| AfterQuery | 4 | $75 to $135 |
| DataAnnotation | 3 | $125 |
Sources and listing historyWhere this information comes from
This listing's history
- First seen here on 27 Aug 2026, and still on Alignerr's list when we last read it on 13 Oct 2026.
- The listed pay has not changed since then.
- Posted by Alignerr
- First seen by AIPayList
- Last seen live
- Listing ID
- 170caccb-ad25-47c2-b1e8-077d7133dc54
Pay as the source states it: “$40-80/hr”.
Platforms sometimes change a rate after posting. Every listing here is re-read at least once a day and corrected when its source moves, so a difference you see on the platform is usually a change made since the last read. How freshness works.
Keep exploring
More like this
Related field, different requirements. Check each role's own page before you apply.